lower license score alert threshold to 9 (#1411)

spencerschrock · web-flow · commit c09630c42e97 · 2024-07-23T19:04:13.000Z
When the threshold was introduced, the license check was a boolean check: 0 points for no license, and 10 points with a license. This later changed as covered in ossf/scorecard#1369 As the last point relies on SPDX detection, it's often flaky. Lowering the threshold allows us to still warn if a license isn't detected but not expect perfection. Signed-off-by: Spencer Schrock <sschrock@google.com>
diff --git a/policies/template.yml b/policies/template.yml
@@ -27,7 +27,7 @@ policies:
       score: 10
       mode: enforced
   License:
-      score: 10
+      score: 9
       mode: enforced
   Pinned-Dependencies:
       score: 10
